CVE-2014-3453

Published May 17, 2014

Last updated 3 months ago

CVSS info 6.5

Overview

Description: Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import. NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:*:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AA9AA3B2-53A6-4EA1-8EB3-A96216275671",
            "versionEndIncluding": "7.x-3.5"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:-:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2105271A-47DB-4B57-A921-D6E35DE47466"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha1:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE2A8ADB-D5AE-454F-9693-43E5268266F5"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha2:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B68F7250-5A82-4893-9A05-E23B18CF37E1"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha3:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "206DE964-539D-474D-8742-11D5CE59052E"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha4:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "339EDB57-8CCA-4D16-9E2E-9944F8F77AC6"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:beta1:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BBCF8C18-6E05-4DD3-A986-DE306AB3E7F5"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:rc1:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "53310BDE-FB58-4932-B74B-28E4A24DBC68"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.1:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F48E13FD-CFCC-41F8-8127-87C819CEE7F6"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.2:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0729F914-0CAF-4C05-B978-A313F955732C"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.3:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E75BD487-C959-4D30-83D3-8FCFC38D0AE0"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.4:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F4D76F04-C3C2-4089-B5D5-4CCF4C2EE1BA"
          },
          {
            "criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.x:dev:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "65B73028-BF40-4EFE-A4EC-5BF4E849F4F0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 2.0

Weaknesses

Social media

Configurations

References